Program did not start
MALICIOUS | SUSPICIOUS | INFO |
---|---|---|
Loads dropped or rewritten executable
|
Reads Internet Cache Settings
|
No info indicators. |
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00426000 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE | 0 |
.mapo | 0x00681000 | 0x00022000 | 0x000216D0 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE | 6.36525 |
.rsrc | 0x0067B000 | 0x00006000 | 0x00006000 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE | 4.81575 |
.mapo2 | 0x006A3000 | 0x0064F000 | 0x0064ECEA | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE | 7.94412 |
No exports.
Click at the process to see the details.
Image |
---|
c:\users\admin\appdata\local\temp\bot.exe |
c:\systemroot\system32\ntdll.dll |
c:\windows\system32\kernel32.dll |
c:\windows\system32\kernelbase.dll |
c:\windows\system32\rasapi32.dll |
c:\windows\system32\msvcrt.dll |
c:\windows\system32\advapi32.dll |
c:\windows\system32\sechost.dll |
c:\windows\system32\rpcrt4.dll |
c:\windows\system32\user32.dll |
c:\windows\system32\gdi32.dll |
c:\windows\system32\lpk.dll |
c:\windows\system32\usp10.dll |
c:\windows\system32\rasman.dll |
c:\windows\system32\ws2_32.dll |
c:\windows\system32\nsi.dll |
c:\windows\system32\winmm.dll |
c:\windows\system32\winspool.drv |
c:\windows\system32\shell32.dll |
c:\windows\system32\shlwapi.dll |
c:\windows\system32\ole32.dll |
c:\windows\system32\oleaut32.dll |
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
c:\windows\system32\wininet.dll |
c:\windows\system32\urlmon.dll |
c:\windows\system32\crypt32.dll |
c:\windows\system32\msasn1.dll |
c:\windows\system32\iertutil.dll |
c:\windows\system32\comdlg32.dll |
c:\windows\system32\secur32.dll |
c:\windows\system32\iphlpapi.dll |
c:\windows\system32\winnsi.dll |
c:\windows\system32\imm32.dll |
c:\windows\system32\msctf.dll |
c:\windows\system32\pcwum.dll |
c:\windows\system32\cryptsp.dll |
c:\windows\system32\shunimpl.dll |
c:\windows\system32\sspicli.dll |
c:\windows\system32\mpr.dll |
c:\users\admin\appdata\local\temp\1476859\12376.dll |
c:\windows\system32\msvcp60.dll |
c:\windows\system32\version.dll |
c:\windows\system32\cryptbase.dll |
c:\progra~1\micros~1\office14\npauthz.dll |
c:\program files\java\jre1.8.0_92\bin\dtplugin\npdeployjava1.dll |
c:\progra~1\micros~1\office14\npspwrap.dll |
c:\windows\system32\macromed\flash\npswf32_26_0_0_131.dll |
c:\program files\google\update\1.3.34.11\npgoogleupdate3.dll |
c:\program files\videolan\vlc\npvlc.dll |
c:\program files\adobe\acrobat reader dc\reader\browser\nppdf32.dll |
c:\program files\adobe\acrobat reader dc\reader\air\nppdf32.dll |
c:\program files\java\jre1.8.0_92\bin\plugin2\npjp2.dll |
c:\windows\system32\clbcatq.dll |
c:\windows\system32\mswsock.dll |
c:\windows\system32\wshtcpip.dll |
c:\windows\system32\nlaapi.dll |
c:\windows\system32\napinsp.dll |
c:\windows\system32\pnrpnsp.dll |
c:\windows\system32\dnsapi.dll |
c:\windows\system32\winrnr.dll |
c:\windows\system32\fwpuclnt.dll |
c:\windows\system32\rasadhlp.dll |
c:\windows\system32\uxtheme.dll |
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll |
c:\windows\system32\windowscodecs.dll |
c:\windows\system32\profapi.dll |
c:\windows\system32\ntmarta.dll |
c:\windows\system32\wldap32.dll |
c:\windows\system32\rtutils.dll |
c:\windows\system32\sensapi.dll |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3596 | BOT.exe | POST | –– | 120.41.41.9:80 | http://ieqgmccbgb66pn86.soft.maposafe.com/wx.php | CN |
text
––
|
––
|
malicious |
3596 | BOT.exe | POST | –– | 120.41.41.9:80 | http://ieqgmccbgb66pn86.soft.maposafe.com/wx.php | CN |
text
––
|
––
|
malicious |
3596 | BOT.exe | POST | –– | 120.41.41.9:80 | http://ieqgmccbgb66pn86.soft.maposafe.com/wx.php | CN |
text
––
|
––
|
malicious |
3596 | BOT.exe | POST | –– | 120.41.41.9:80 | http://ieqgmccbgb66pn86.soft.maposafe.com/wx.php | CN |
text
––
|
––
|
malicious |
3596 | BOT.exe | GET | –– | 218.93.206.121:888 | http://218.93.206.121:888/L(7~.dll | CN |
––
|
––
|
malicious |
PID | Process | IP | ASN | CN | Reputation |
---|---|---|---|---|---|
3596 | BOT.exe | 120.41.41.9:80 | Xiamen | CN | malicious |
3596 | BOT.exe | 218.93.206.121:3600 | No.31,Jin-rong Street | CN | malicious |
3596 | BOT.exe | 218.93.206.121:888 | No.31,Jin-rong Street | CN | malicious |
PID | Process | Class | Message |
---|---|---|---|
3596 | BOT.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojWare.Win32.Agent.ISVQ server response (HackingTeam) |
3596 | BOT.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojWare.Win32.Agent.ISVQ server response (HackingTeam) |
3596 | BOT.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojWare.Win32.Agent.ISVQ server response (HackingTeam) |
3596 | BOT.exe | Potential Corporate Privacy Violation | ET POLICY Unsupported/Fake Windows NT Version 5.0 |
3596 | BOT.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojWare.Win32.Agent.ISVQ server response (HackingTeam) |
3596 | BOT.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojWare.Win32.Agent.ISVQ server response (HackingTeam) |
Process | Message |
---|---|
BOT.exe | WebPageImpl::~WebPageImpl: 01F1B7C0 |
BOT.exe | WebPageImpl::~WebPageImpl: 01F1B7C0 |
BOT.exe | WebPageImpl::~WebPageImpl: 01F1B7C0 |
BOT.exe | WebPageImpl::~WebPageImpl: 01F1B7C0 |
BOT.exe | WebPageImpl::~WebPageImpl: 01F1B7C0 |
BOT.exe | WebPageImpl::~WebPageImpl: 01F1B7C0 |